649882 - Unable to stay logged in when shutdownhtml is active

Status: NEW

(Bugzilla :: User Accounts, enhancement, P2)

Description

[Dave Miller [:justdave]]

Bug 273767 complained that users were unable to log out when shutdownhtml was active, with a pretty compelling security case for why that was a problem.  However, it was fixed by automatically logging out everyone when the load a page while shutdownhtml is active.  If the site is only down for a brief minute or two (say to add a custom field which can't be done easily on a busy site with people actually accessing it) this throws a kink in user workflow for people who might have been trying to submit a change when it went down.  It's nice to stay logged in so that when it comes back up, hitting reload will just send their change through again without having to go through all the login stuff again on the way there.

Since we can tell if a cookie is present or not (we check for it already to see if we need to log them out) we should provide an option to allow users to log out manually instead of forcing them to log out.  This would solve both problems.

Comment 1

[Max Kanat-Alexander]

Agreed. Ideally, as part of this, we'd make logout a global action instead of being part of index.cgi, but I seem to recall that being very difficult when I tried it before.

Comment 2

[Frédéric Buclin]

We are going to branch for Bugzilla 4.4 next week and this bug is either too invasive to be accepted for 4.4 at this point or shows no recent activity. The target milestone is reset and will be set again *only* when a patch is attached and approved.

I ask the assignee to reassign the bug to the default assignee if you don't plan to work on this bug in the near future, to make it clearer which bugs should be fixed by someone else.